Fleekdash V2
Monthly
Full account takeover in the FleekDash V2 WordPress plugin (versions ≤ 2.6.2.2) lets a low-privileged Subscriber overwrite the email address and password of any user, including administrators, via a missing authorization check (CWE-862). The impact is amplified because the public /wp-json/fleekdash/v1/register REST endpoint auto-provisions a Subscriber account and returns a valid REST nonce regardless of the site's users_can_register setting, so an attacker needs no pre-existing credentials - one prior request bootstraps everything needed for the takeover. Reported by Wordfence with a CVSS of 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full account takeover in the FleekDash V2 WordPress plugin (versions ≤ 2.6.2.2) lets a low-privileged Subscriber overwrite the email address and password of any user, including administrators, via a missing authorization check (CWE-862). The impact is amplified because the public /wp-json/fleekdash/v1/register REST endpoint auto-provisions a Subscriber account and returns a valid REST nonce regardless of the site's users_can_register setting, so an attacker needs no pre-existing credentials - one prior request bootstraps everything needed for the takeover. Reported by Wordfence with a CVSS of 8.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.